Skip to content
CVE PROGRAM SOURCE RECORD2.2 Low

CVE-2024-8013

CSFLE and Queryable Encryption self-lookup may fail to encrypt values in subpipelines

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mongodb

Description

A bug in query analysis of certain complex self-referential $lookup subpipelines may result in literal values in expressions for encrypted fields to be sent to the server as plaintext instead of ciphertext. Should this occur, no documents would be returned or written. This issue affects mongocryptd binary (v5.0 versions prior to 5.0.29, v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) and mongo_crypt_v1.so shared libraries (v6.0 versions prior to 6.0.17, v7.0 versions prior to 7.0.12 and v7.3 versions prior to 7.3.4) released alongside MongoDB Enterprise Server versions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

MongoDB Inc mongocryptd

Default version status: unaffected

  • 5.0 to < 5.0.29affected
  • 6.0 to < 6.0.17affected
  • 7.0 to < 7.012affected
  • 7.3 to < 7.3.4affected

MongoDB Inc Mongo_crypt_v1.so

Default version status: unaffected

  • 6.0 to < 6.0.17affected
  • 7.0 to < 7.0.12affected
  • 7.3 to < 7.3.4affected

References